Skip to content

Commit

Permalink
fix(80525472): fix redirect
Browse files Browse the repository at this point in the history
  • Loading branch information
Felipe Pedroso Ramos committed Sep 21, 2024
1 parent 9656134 commit 88b966b
Showing 1 changed file with 4 additions and 23 deletions.
27 changes: 4 additions & 23 deletions Project/Project/Controllers/ReviewController.cs
Original file line number Diff line number Diff line change
Expand Up @@ -132,17 +132,7 @@ public async Task<IActionResult> Delete(string movieId, string route)
} else
{
TempData["SuccessMessage"] = "Review has been successfully deleted.";
var refererUrl = Request.Headers["Referer"].ToString();
var allowedUrls = new List<string> { "/home", "/profile", "/reviews" }; // Add your allowed URLs here
var uri = new Uri(refererUrl, UriKind.RelativeOrAbsolute);
if (!uri.IsAbsoluteUri && allowedUrls.Contains(uri.LocalPath))
{
return Redirect(refererUrl);
}
else
{
return RedirectToAction("Index", "Home");
}
return Redirect(Request.Headers["Referer"].ToString());

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection due to
user-provided value
.
}
}
else
Expand All @@ -152,19 +142,10 @@ public async Task<IActionResult> Delete(string movieId, string route)
return Json(new { success = false, redirectToLogin = true, message = "User not logged in." });
} else
{
var refererUrl = Request.Headers["Referer"].ToString();
var allowedUrls = new List<string> { "/home", "/profile", "/reviews" }; // Add your allowed URLs here
var uri = new Uri(refererUrl, UriKind.RelativeOrAbsolute);
var returnUrl = (!uri.IsAbsoluteUri && allowedUrls.Contains(uri.LocalPath)) ? refererUrl : Url.Action("Index", "Home");
return RedirectToAction("Login", "Auth", new { returnUrl = returnUrl });
var originalUrl = Request.Headers["Referer"].ToString();
return RedirectToAction("Login", "Auth", new { returnUrl = originalUrl });
}
}
}
}
}






}

0 comments on commit 88b966b

Please sign in to comment.